LINE client for iOS prior to 10.16.3 allows cross site script with specific header in WebView.
linecorp line